docs: def options(self, *args, **kwargs):
          """XHR cross-domain OPTIONS handler"""
          self.enable_cache()
          self.handle_session_cookie()
          self.preflight()
  
          if self.verify_origin():
              allowed_methods = getattr(self, 'access_methods', 'OPTIONS, POST')
              self.set_header('Access-Control-Allow-Methods', allowed_methods)
              self.set_header('Allow', allowed_methods)
  
              self.set_status(204)
          else:
              # Set forbidden
              self.set_status(403)
  
          self.finish()